From patchwork Thu Sep 20 00:21:37 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10607597 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 261CE14DA for ; Thu, 20 Sep 2018 12:35:18 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 143E62D337 for ; Thu, 20 Sep 2018 12:35:18 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 07DFE2D3C7; Thu, 20 Sep 2018 12:35:18 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI,NO_RDNS_DOTCOM_HELO,RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from USFB19PA12.eemsg.mail.mil (uphb19pa09.eemsg.mail.mil [214.24.26.83]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA256 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id A46D82D337 for ; Thu, 20 Sep 2018 12:35:15 +0000 (UTC) X-EEMSG-check-008: 216325320|USFB19PA12_EEMSG_MP8.csd.disa.mil Received: from emsm-gh1-uea10.ncsc.mil ([214.29.60.2]) by USFB19PA12.eemsg.mail.mil with ESMTP; 20 Sep 2018 12:35:13 +0000 X-IronPort-AV: E=Sophos;i="5.53,398,1531785600"; d="scan'208";a="16048586" IronPort-PHdr: 9a23:NquCWhIyqD+5gKQg59mcpTZWNBhigK39O0sv0rFitYgTLf/5rarrMEGX3/hxlliBBdydt6obzbKO+4nbGkU4qa6bt34DdJEeHzQksu4x2zIaPcieFEfgJ+TrZSFpVO5LVVti4m3peRMNQJW2aFLduGC94iAPERvjKwV1Ov71GonPhMiryuy+4ZLebxlKiTanfb9+MAi9oBnMuMURnYZsMLs6xAHTontPdeRWxGdoKkyWkh3h+Mq+/4Nt/jpJtf45+MFOTav1f6IjTbxFFzsmKHw65NfqtRbYUwSC4GYXX3gMnRpJBwjF6wz6Xov0vyDnuOdxxDWWMMvrRr0vRz+s87lkRwPpiCcfNj427mfXitBrjKlGpB6tvgFzz5LIbI2QMvdxcLndfdcHTmRfWMhfWTFKDoelY4cSE+YNOOBVoI7/qFQUrRu+Ag6sCPr2xjJUiHL73LA23/09HQ3bwQcsG8wCvGjRoNjzKawcU/26zLPQwDvdYfNY2TTz5obGfR8uo/6CQKpwfMjMxUQhCwzLgUufqZf+MjOJ1OkAqXSX4/ZuWO6xjWMstgF/oiKoxscpkoTEmJgaykva+iR53Y07OMG3SE5hbt65HptQsz+VN5FrSc4lX25noj06xaMGuJOgZygF1JQnyATCa/yJd4iH/AjjWP+NLjhinn5qZLW/hxOr/EWm1+byVdG03U5XoidKndTArHAA2wHJ5sSZRfZx4F2t1SuX2w3S6OxIO104mKvfJpI7w7M9loAfvVrdEiL5nkj9kbWYeV8++uey7uTqerDmppiBOIBqkgz+KaEumtCnAeQ/LwgOQ3CX+eSi273n+k30WKlKgecskqnYrZDaPt4XprK5AgBJ0oYj7AyzDzG639QDgXYLNldFeBODj4TxOlHOJu73DeunjlixnzpmyOrKM738DpnXMHTOn6ntcaxg50JEzQo819Ff55ZaCrEbJ/LzX1f8tMfGAR89Mgy0xfvnCdpk2owFXmKPH6mZP7/Mvl+T/e8vP+mNa5MVuDb6MfQl4eXugmUjlV8Seqmpw4MbaGqkEfR+P0WZfX3sj88DEWcNuAoxVvDqiF2YXj5VfHuyXaU85jc+CI28FofDWp6igKaa3CuhGZ1WfG9GAEiWEXj0b4WER+sMaCWKL89jkDwLT6SuS4w61RGpsg/6yqRnI/Ha+i0cqJLi28N65/DVlREu6Dx4FcOd03uCT2tshGMHWyc23LxjoUx60lqDybZ3jOdGGtxV5vNJTgA6OIXdz+NkFd/9RBjNftCTSFapWt+mGy0+Tsotw98SZEZwA8itjhfF3yqsHrAaibiLBJ0v/63GwXfxPcF9x2zB1Kk7gFksWtFPOnG+hq5j6wjTAJbEkkuYl6aucKQTwjTN+XyNzWWQoU5YVxRwXr/dXXAFYUvWr8r26V/eT7O0DrQnKARBw9aYKqRWct3pkUlGRPD7NdTdeW2xmGCwBQuTy7OPdoXqeGId3DjHBEgDiQAT8m6MNRIiCSe5v2LeEDtuGEr1bEzx6+l+qW20TlUvwg6Qc0Jh0qC5+hkPhfyTU/kTxK4LuD89qzVoG1awx87ZBMCEpwV/Z6VcfdM84FBc2GLCqwN9P4KvL6Z+hl4faQt7pUXu2AtrCo9Yi8glsGsqzBZuKaKfyF5BbS6X0o3rN73YL2nz8wqja6jI1VHCyNyW4LsA6Owkq1X/uwGkDlEi83t909lSyHuc+o7HDBEUUZL2XEc38gJ1p7fAbik7+YzUyWVmMbOovT/ax9IpGOwlxw6ufthFNKOECBH9E9cBB8W1NuwlhUKpYQkZPOBX7qI0ONmmd/Se0q6xIOlghC6mjXhA4I1l1EKM9i58SurW0JYe2PyXxBWIVy37jFu7tcD3g49EbykIHmWj0SjkGJJRZqpqcIkWFWehOde3y85iiJ7qXn5X6ESsB0ga2MOzfxqdcUD91xVK1UsLuXynhTe4zztsnjE3r6qQwDDOw+P4dBYdJmFLRG5ijVHjIYWvi9AaXU6oYBIzlBui/0r6wLJbpKtnJWnJXUhIZzT2L31lUqaosrqCYtVP6I8xvSVMTuu8ZVGaSrjgoxoVyC7jBHNexDE9dzGrppr5hAZ2iGSDI3ZvtHDZY91/xQ/D5NzAQv5cxiAGRC58iTnTGFe8JcWm/dKalprYqeC+Sn6uVoZJfSns14OAuzOx5Xd2Dh2ng/CzhtrnHBA50SDl0dlqTj7FrBXibYntzKS6N/xoflVyCF/78cp6FZl0kpEsi5EIxXgampKV8GIfkWjpLNVb3bzxbGIXSj4N397a/hLl1VZ+LnKS2Y35TG6dztF6Z9m9f2MWwD4y4N5ECKeT9rxEkjV6rkC+rQ3Pffh3hi0dxuc26H4Gn+EJvxIgzjubAr8PBkRYIyrsmAmI79ykqqVYenqve6Cq1EVihdChEK2CogZEVXbhYJgiACtw495jP1LNzH3y6pjoeNfKYtIVrBGUlA3Aj+dNIpIrivUKnTZnOX76vXA9yO46jRhu0o+hsYiCLGVt8qy5DQBENj3pZ8MT/TTtgrhEksaQwY+vAo1rGi8XU5vwUfKoDDUSuOzpNwmUFj08tnCbGb/EEA+R9khpsnXPE4qxOHGPPnkZytdiSweBK0xDmgwUWy86npEhHACw2MPhaFt55iwW5lPgpBtM0PxnOATkUmjFogeodjA0SIOEIRVM8g5C4l3ZMcuE7uJ8BytY5IGurBSRKmyHYARFFXoGVVeDC1DnP7mu/sXA8/OCCuqlMfTBfa+CqfdAWPeMxJKv1JZm/jmXO8qTPnhiFeA72lFZUXF3AcvZhy4PSysRly7XaM6bvhi88DVtrs+j6PTrRB7v5YyXBrRJMNVv9Be2gaGYOuGNmil2MjdY2YkKxXPSz7gfxlESgTl0dzaxCbQAqTLNTKXIl69VDx4aaztzNMxM76I9wglCJ9XWitb01r5klP46FU1JVVv7msGmfcYKOX2yNEvbBEaXM7SLPSPEw9ntbqOmSL1Ql/5ZtwWqtjaBEk/jJSyDlz3zWB+zL+5AliabPAZRuIulaBZiFXDjTM76ah28KNJ3iyM5zqcwhn7RNm4cNiN8c19Xob2W9iNYgfR/F3ZH7nV7MemOgzyZ4PXAKpYKrftrBTx5l/hE73Qh1bRa9jtES+B1mCbJtdFuokumnfSIyjppSBpOsChEhYKRsUVkJ6rZ6oFKWWzY8xIV8WWQFxMKqsN4BdL1paBQy8XAlLnoJThY6dLU58wcBsbPKM2ZLHUhLADpGD/IDAoFVzKrM3/Qh1BFmvGI6nKVtoQ6qoTrmJcWTr9bU0Y1Ge0cCkVkG9wPO5h3XjU5kbKBi84I/3W+pgHLRMpGppDHSu6SAfL3JTaCk7ZEYxoIwbXlLYUcLYD0x0tialxmk4vQAErQQcpBoit/YQ8ouE9N6mRxTnUv20L5bQOg+GIcGuKxnh4xjAt+ffkh+Szy41gpPFrKpSoxkE43mdn/hzCebiLxJr+qXY5KEyr0q1QxMpTjTgZpbA2ymEtkNCvER7NRlLZvaGFriQ/GtpRUA/JcS7NLYAMIz/GNe/ooyUhcqjmgxUJf/+TFDZpimxc0fpG0qnJB2wRjbNkzJaPKP6dG1VlQibiIviOx2OAx3RUSJ0AT/2OOYCQIolAHNqE6Jyq0+exh8ReNlCVFeGUXTfUlv+xq+V0nO+Sb1S3gyb5CJlq2N+yFIKOTo3LAmtKQQlMsykMIkFFI/aJw0ccib0WUV0cvzL+KFxoRLMTMNBtbYtZV+nXIYSmOtuDNzo5vMIWmCuDkV+mOu7gIgki8BgYmA5wM7tgdHpmryEzXMcXnI6QZxhg2+AvrI1GFDPBIeB2VijcHv9+ww4N33YVHITEdG2p9Oz2t5rnLvg8qnOaDXNAub3cARIQELHU2V9ahli5FpXRPFie33fwdyAiD6T/8qSDQDDjzb9pjePeUawljCMuz+Tkl9ai5l0LX+I3EJ27mLdRipsPP6eQCqpeJEf9bUbl9s0bZm4lZXXOqUHXCEd+rKJfudYYgd9v0Cmy1UlankTI6U9/xPMqxLqiPmQzoQJxbsJOY3D89Kc+9FzceGxhrquAN/q18YxEMY548YR71qgs+LLazIAGG3dWyW2ytMydZT+FDzeWmYLxa1zIsbui+yHQ6VJE7we638UoDRJwRixHewvGjZ5JAXifvAHxdfB7PpTE4l2hnOeY+2OA/wAnHsVMEKTCEaPRpaHBYv9E7HV6dO292Cnc+R1OGjorO+Q+s37ET/ytBhNlYy+tFv2bivpXHejKjRLSrqYnJsyonddUmv6pxMYn4L8uaqJ/emyfQQIPWsgKbTC6wD+BalcRIICJEXPlInnkoOc4BuYVf8kc+S9kxJ6dRB6k2urCldydrATQUzSAHS4OKxCYCjfuk27vGiheQd4wvMBIesJpYhNsSTy92YjgFqa+mT4XWlnaISnMFIQcI9whM4xgAloBodOD//IXIVINMyyJRo/9sTivEC4Rn91rhRWGSmlX3VPKhk+m10g1I1/LszsMXWBhhBkhB3+xWjFcnKKlrK6kMuY7HqieIdVjmvG331eSmOEJcydbTd13lForKqXTzUisA+X0OX4BPzGvTFZMIkwp2cKwrvklDIJi6ekbi4Dwp359mH7ekWsy3xVspsHgLSjy2HNpGDuFprEjYWCZ5Y5yxrpXqJYlSSHdK+JKBs1dZjFltMymhxJpGNc5C/z4MUyJToTiGuNuyT9ND1tFoA5AQJddwpmnyFLlCOJePv308oqbvxWPB+zAgrFe6wy2+G7OiT+1H4WIRBx4kJ3maqkkzFesj6HnS8lHKslBw4ehbGqKDjUJroDZyBppOHCpG1Wi5L1RvS3lLq+BaJ77Rc8xYXfYyeQOvNAYkGvM92UyG4110nWzlbCNorgtV5TrRXw8qWikJmr3tgyERqtm7OT8GTJJFdTchYD3fKwKcgiBXuAxQa19xVpAcH9ZF/60b3YpI8crDU0msLzoFUAZlNgIi3vpVjVRDv1mAeSDBEQqocu7Csh9tcseXos6pNvP58xpZhY78rOA37aMDR2ahmQG3R9DRsZP8vMWQtkSSbKf4L/G8YXjZQTjDkBCwhLMkD53U8CjWKwdUNod1xmElYZf7D27HJxNGJ7gUJ0BDT6B1dc1GovxGZ89jYKsJ+65tBhecSxPqBoOurOdJLkzSRTTYICWN6Oq/rpzP7bbFU+jvetSMx2rbQ6JwJpp67z37Fqzr0Y9Y/0r6wPZt9kV0SVjcKS+Bt8jhJhkW5Ma+akvio4cpEi3MDJd3inrtyVlKd9ALTC2y7JQY1JRZ5W71SeJ/1EjzrOJS+Kd/5Iky4rBm08G0KrnOKfVUtk9nGBuUBh5w+pUrHmd/W3hbYvUNJ/fJYaQZkcfupvjzF6wM7R2Y+/dUadXZKE7cncm/ECuTSQRenAcGqz4VMBeT1+Kfl69zU8alqvDz2lgx7FimMh4G0Ldt6J+F+quJvuDYdQfewKMfWqf0WsP8sKgjt1mV5f0+m74EYnZ1bBG/EOgBSs4dwX/twrsrzSI3HcLMBbDg+P9fV3IhhD3ghpR9Ek4KFfMTALWE455Rnnoim+zeLN0ZaLpOmmGVFR6rCrUC02Kk6zOLIGl5hRHDywnwTnmv7FDqrS95TyzMz83gkkZMTbm4G0NSXyuvOU9lvzKCJxLou8Druasp7EE3PGvktMiOlGe7O7NYAdf/JNqCLikwvl4Xi4cxRtO304ABBdW9OMsR8G15bvbG5GOkjSlBo7tAh4rZ5c2V4evYHX2hj62ctrWMyytVynwmslEl6tGvLOvC59uUTPS0z2wRVTtwuxPdXx6prbzWt1YUOU2X30fMnIwFJMpZ0WM51kHh4+gjW8kz+R5bFovPaPIOvzfzOCH7wVyHedI4SjGe0ydLHlLyCVR4F7Qz2HnrvM7QiHne9FsmRoh2d0z6ih16FIo4KUc351gR3CUPCw8NaQqUDLuwH0TqMZMEVVQfaRSAxLW6eKA33U11wr+1+ODTbeh8B7cQOfdcjw6OmkNbGpEXsaAFXrJ8ekFd+7TTpgf/CojrRf7mmmQsNfetWMBV7dgZt2c+4ga4Xxeg6IlD4KwdiJ2Tcq5EfIXDvMF770d8/zIPcTZNgBdnhROjTe8cvPzj4sTcsJew6OahSqgtR+sT9xUvCWVxlZ3wj04/od3N0edTVJHVg5zl8A9RO36KpJra0x5kJOoBL4Kre7hh+GsDJygaPH8OJt2Wa/894yBxKjnT4UJNAt8Ub9MCIMXNgRxUilHuWLxL88rbG1yYC4R0d80z7Wr40jM18Zw6Uun+7j+6P5bf4E9RP/lbliVjiMrCpPQJwfrVECUY+meWax5pwi6Z0JmND/Hw/fmQyNHKSVwJAzQ6U4BHJDqN4QanXPa6lI31UgOI7c/+mJw+e1yURnywhKQKrL1BEO9BiiX+2zhRCJr1h/aLvNa272tXrFJHGp5p7RLZAKVfIol7ORPgm8ilXkh8HCr/d93KeRc1veqWx/sM4/9gOEfkYo8bOB0Ewarg6XVJVgtuVKL2vlGBUOIWYNtpVujJrmhR6Y16MK8PIFmdq4D2rjdStl85HhUlaLkuoTxGbkPOhhFaW77ouL4cjQsRSdp5uU5KGWKtN2My/j7HVaVOjKmNE/wY6TSTQbYIU0VvKC9+RAm12Jp2cbuzgf9Hqn9Gnj96oPUy1jxpXgezuS3tp6IL3jIt46+4tDQHuXNbSuWekiHICUhMzfgQiqccEXni40SmYHYfdIvy/KVnJcP4+Ikj+Xs/YhIjcDYdUOS9DSHwk6OIAouSsNJThB6NpN/CbbmtIigOLr490w7sR2Bh0gjCmxZl6HALQjul7NA4JYiwOt0oxjS2FmjBdVYN46RJsM3ruV4NUuQ2dQAp/GI29vOiDnkJRcrSCyMugwM5c2RYYddG7hMHE6QAnDmFpO9F8xsSbTOSFZ6qrM2Yv87N1GJ1aNBw3GPN7vmHg5Qwynx+s9V96yOP/nMIeLqcG/RBSlzy0JpPgbjlavGstP0XYJd3w7SmFvkZO4+s/nXgnN1OeWuAjuAaHlykIKoAy63dXiONV2KVQ6KIfnKKkjJ/NVT9s13gDFo3bo9oqE80NPDPgNYIlQrhV/V2QSWZo0TWykQoOOUdcQM9sYPhcAsPGqpZROWRPqAFx/o9QA8PYnLSFixxCMe9sUSqmYlmPjNn+0qsJazR/xz9LdzaOhACHYeS+oZ8//OnR2TEOnJ6yhB2FEgx8+DBGhIqv+xBaZ/Xm9WWhcwtlaY9fuppeQg6vcQe0tZ74JSQ+N+DbBWUy5H1P9yTqf+dVbmX9FgnYmFXVPIiZArx44grdooiV6b7AapSvRNaA7MzBpMmKTG1vOtwLQVuYkvff7i5nMTujvyEa4ESpHLM6F80aiDGtFdLnvi1SxFrKp6xi3jsLZQYWD1MtZtuBwFgEY8JHNkP+U7vKpqZiKyqw/O28Vl7quYM+f75BvfAztWo1oNZUJ1T5EjNNzHUUu0jp0Vuje0xhsD72534ncWqLdYFX8B3Q2HEabjKWIOyNmTKcvn1f1BP77mG3fpcXw6WfinyVuLSr2uhOe5j+0www9UmVOXWxT0pqbrc3Y2hSXtco3KIpGWEJdNk51zDGOLaUggcHfGM62t0NbYcbYLp+uMDK5kpyZ6X5Awlv2cK69eMP6X09hyE4Ul8b5+OaRqxgXxrUJQWIBm5LUoniHPYrXKYG3lHM8y4MpMx24SoNjDGvGJJsDl8IGNMH3HnA9KYOGxd3sO6N2jovBlTAYMlmOi6MVU9qrX0UfNhb55Mgui7nK4Mkd90JSXCXo1RNmfbK7olW1gZFf3B8X4vZBNMqL0pQsEwbJmKLlkANRKLwDj/3CPZ2k39atKo2bzMKy9Q+XJCnNenmSNUqVyfvvCUytbmTKifbJzyW6vKNzE5UziBWTkoOV2u/1av4KJZ+aPAZ2wYpEsReGSXAQ8X4Kph957BB2/Unqtoe5hZ4ZLSVyPxTXhgnbEpTmZQtE+KSuYeDwSecXL7gWRdtQDjbv9B9H7odfuZk4JEUuwRBc1HdfiU X-IPAS-Result: A2CRAACWkqNb/wHyM5BbHAEBAQQBAQoBAYFQggUDgQhcKIwIX4tRgWiBHYFhk3UUgV8qEwGFBIJ+ITQYAQMBAQEBAQECAWwcDII1JIJgAwMBAiQTBgEBDCAMAgMJAQFACAgDAS0UAREGAQcFBgIBAQEYBIMAgWoDFQOYXIocgWozgnUBAQWBBAEBdYJEA4JRCBeKWBeCAIESJwyCKoIJgncBEgGFd4g+hXoxRo1BCYIMjhIdWIg5hhGObIdLOGRxTSMVO4JsghkMF4NGihwBVU97AQGKOoI9AQE Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by EMSM-GH1-UEA10.NCSC.MIL with ESMTP; 20 Sep 2018 12:35:12 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus.infosec.tycho.ncsc.mil [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w8KCZAR9025645; Thu, 20 Sep 2018 08:35:11 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id w8K0LkeP024265 for ; Wed, 19 Sep 2018 20:21:46 -0400 Received: from goalie.tycho.ncsc.mil (goalie.infosec.tycho.ncsc.mil [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w8K0LjnN020818 for ; Wed, 19 Sep 2018 20:21:45 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1ATAADe56Jbly0bGNZcHQEBBQELAYFQggWBZyiDc4gVX4tSgWAIgR2BYZN0gXqEdwJCgnkhNBgBAwEBAQEBAQIUAQEBAQEGGAZMhUUDAyMEGQEBOA8lAiYCAkUSBgEMBgIBAYMdgWoDFQOZboocb3szgnUBAQWBBAEBdYJMA4JRCBd0iWIXggCBEicMgiqCCYYrgleIOYV4MUaNNgmCDI4RHViINoYMjmqHSYINTSMVO4JsghkMDgkRgzSKHAFVT41sAQE X-IPAS-Result: A1ATAADe56Jbly0bGNZcHQEBBQELAYFQggWBZyiDc4gVX4tSgWAIgR2BYZN0gXqEdwJCgnkhNBgBAwEBAQEBAQIUAQEBAQEGGAZMhUUDAyMEGQEBOA8lAiYCAkUSBgEMBgIBAYMdgWoDFQOZboocb3szgnUBAQWBBAEBdYJMA4JRCBd0iWIXggCBEicMgiqCCYYrgleIOYV4MUaNNgmCDI4RHViINoYMjmqHSYINTSMVO4JsghkMDgkRgzSKHAFVT41sAQE X-IronPort-AV: E=Sophos;i="5.53,396,1531800000"; d="scan'208";a="373948" Received: from emsm-gh1-uea10.ncsc.mil ([214.29.60.34]) by goalie.tycho.ncsc.mil with ESMTP; 19 Sep 2018 20:21:45 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0ARAAAv56Jbly0bGNZcHQEBBQELAYFQggWBZyiDc4gVX4tSgWAIgR2BYZN0gXqEdwJCgnkhNBgBAwEBAQEBAQIBEwEBAQEBBhgGTAyCNSSCYAMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVA5lzihxvezOCdQEBBYEEAQF1gksDglEIF3SJYheCAIESJwyCKoIJhiuCV4g5hXgxRo02CYIMjhEdWIg2hgyOaodJgg1NIxU7gmyCGQwOCRGDNIocAVVPjWwBAQ X-IPAS-Result: A0ARAAAv56Jbly0bGNZcHQEBBQELAYFQggWBZyiDc4gVX4tSgWAIgR2BYZN0gXqEdwJCgnkhNBgBAwEBAQEBAQIBEwEBAQEBBhgGTAyCNSSCYAMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVA5lzihxvezOCdQEBBYEEAQF1gksDglEIF3SJYheCAIESJwyCKoIJhiuCV4g5hXgxRo02CYIMjhEdWIg2hgyOaodJgg1NIxU7gmyCGQwOCRGDNIocAVVPjWwBAQ X-IronPort-AV: E=Sophos;i="5.53,396,1531785600"; d="scan'208";a="16038271" X-IronPort-Outbreak-Status: No, level 0, Unknown - Unknown Received: from updc3cpa06.eemsg.mail.mil ([214.24.27.45]) by EMSM-GH1-UEA10.NCSC.MIL with ESMTP; 20 Sep 2018 00:21:44 +0000 X-EEMSG-check-005: 0 X-EEMSG-check-006: 000-001;733eb730-09fe-4e96-b462-523609ce6ace Authentication-Results: UPDC3CPA09.eemsg.mail.mil; spf=None smtp.pra=casey@schaufler-ca.com; spf=None smtp.mailfrom=casey@schaufler-ca.com; spf=None smtp.helo=postmaster@sonic305-10.consmr.mail.bf2.yahoo.com; dkim=pass (signature verified) header.i=@yahoo.com X-EEMSG-check-008: 53389840|UPDC3CPA09_EEMSG_MP25.csd.disa.mil X-EEMSG-SBRS: 3.5 X-EEMSG-ORIG-IP: 74.6.133.49 X-EEMSG-check-002: true X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0BPAAC15qJbhzGFBkpcHQEBBQELAYFQg2wog3OIFV+NMgiBHYFhk3SBeoR3AkKCeRkGBjAYAQMBAQEBAQEBAQETAQEBCA0JCBsOIwyCNSSCYAMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVmXWKHG97M4J1AQEFgQQBAXWCSwOCUQgXdIl5ggCBEicMgioHggKGK4JXiDmFeDFGjTYJggyOER1YiDaGDI5qh0mCDU0jFTuCbIIZDA4Jg0WKHAFVHzCNbAEB X-IPAS-Result: A0BPAAC15qJbhzGFBkpcHQEBBQELAYFQg2wog3OIFV+NMgiBHYFhk3SBeoR3AkKCeRkGBjAYAQMBAQEBAQEBAQETAQEBCA0JCBsOIwyCNSSCYAMDIwQZAQE4DyUCJgICRRIGAQwGAgEBgx2BagMVmXWKHG97M4J1AQEFgQQBAXWCSwOCUQgXdIl5ggCBEicMgioHggKGK4JXiDmFeDFGjTYJggyOER1YiDaGDI5qh0mCDU0jFTuCbIIZDA4Jg0WKHAFVHzCNbAEB Received: from sonic305-10.consmr.mail.bf2.yahoo.com ([74.6.133.49]) by UPDC3CPA09.eemsg.mail.mil with ESMTP; 20 Sep 2018 00:21:42 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1537402901; bh=GPXUNLAkEy+eMHGlJ4pFpqjeBV7kReWHlmogi41aaT0=; h=Subject:To:References:From:Date:In-Reply-To:From:Subject; b=ISM21s+xiKN8DQU6IRJE81MjP42fZE88gctOak19BLya2sPaPdhFMTKpK5/bEgKM4hi6VGt45AHwIaP4DRkagEj0WNC3aHrEudlXKijWb8O6zihHqho3YesQZPj2OAzKinh2ntnG2a1/QcuLv1aRM7FgWgvqPV524rkbyPrAvVMMMKwIQ1f28uiuujmNiLD7uDQ7fQzyHYChsaOoj77VKpZ+VDMDsrvAF1WRgSB44oJQ0uprd0ncAyFOVh+Rr4evt544KkBmGANJoS28Sr6if7R/0EWz14mko78bKK7emfX9wVLZ1a4427qqWWlY7WKxxfHJzNmhnQK4qvmsyUchtg== X-YMail-OSG: SHlS6xoVM1ma_q2qRz2bGSDTKMcUhgWOGryrmYLQVJ_HZD7tYF5eLwc4LctObed snFpuF7wZxEcjs4W177ZyJZFrbQ1Rn85chQ67eIC7RQ8NySuMoIWIufrPnNZnEQWsBlT_s_AVkJh 03RZco3hgN0eO1B_37MFgLDlbaYGExKxq_7.Znh5FTHZQRV5EvMOvzCDkbo.3KszWT5wd2QCzxZi AQhkbFiIN9xExHJrk2qGD9SGzZUCmUtM.5saZ25Hxf0H.9PQo_DhmGgRBEPfs8YC5iEB25lZtsQ5 lAxonVDXNvtlVqobPjbc.Y2NFrQC1tUr92.214x9A3OKTarnb7eBmBHNwlyI8M8umb5O.U0K0uE5 3pfjTA.u8JFAncM._.FcB1Q0rS0UiTVE9TExzWoQCw5jkdkL77Sz08crbakVonvpKa0_3Me7gsTW IaeOYkKZFXqaF9RG1Atkvn0kacwTCF2NQlCLzlg3uh3nD1WHYRvDdul1AGk8NuUtR3Hru8bDzuBA 65Q2ORJKybYaM5R1pNu2MmdnjIlYqSRMWo2kXj01DeO9aMpbNWWvIX.wqzYPMij5JnKsk4pVgVJQ paHL9n43y6Ls8ZSYq_LfKnMklf9ne.0Km5ynfO50iDupv5lywZOdGtmicCqd79xOMyz_1nSdCNVA hr4KzBmwlZuMlTNvOhjH2knJHDe11AdBFKSMlSz93VLvEP6mAK4hu7pg7RjaeUeF1I9qtG_y2F4k 0dA0Mk3tsxgJQxRShPkDlOTiRDq6DLgOqn7z71oS5yl2pwFTQGjKgZbBqfdRPvvuikioGVi_O2M5 kY06iZBAdx7wg34u1KRkcUKHfvaldzpPHDV0jk48Q8xcEneVrHfAMY6Y0sDWk2gCIRjpqR424kKL KQbWmJNsQ.gqxtwb8nO7RlfYPmBKaTyakcG2XKyhX0SV3Ox6PW2L2TOQpMnOyavp0NMZjrpizKfT kt_sg7bD.qcQ0DDlkhXan2kbODRt8ez9bri_i4tk0TRAbrfi6zp5hgdXeu1l1BTwE6WQ1.7nh1AL VPcvXrCXrSbdLeGqkgAXFjqVSlfe8KowdEPrxoBx4vog- Received: from sonic.gate.mail.ne1.yahoo.com by sonic305.consmr.mail.bf2.yahoo.com with HTTP; Thu, 20 Sep 2018 00:21:41 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO [192.168.0.102]) ([67.169.65.224]) by smtp431.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID e2b26ff7e3dca2de47e7525db215d492; Thu, 20 Sep 2018 00:21:41 +0000 (UTC) To: LSM , James Morris , SE Linux , LKLM , John Johansen , Kees Cook , Tetsuo Handa , Paul Moore , Stephen Smalley , "linux-fsdevel@vger.kernel.org" , Alexey Dobriyan , =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= , Salvatore Mesoraca References: <748c61cb-b6fa-c36d-a7b3-2315ff6292af@schaufler-ca.com> X-EEMSG-check-009: 444-444 From: Casey Schaufler Message-ID: <6456aa25-6890-6d54-51c5-03c5daf0c6fb@schaufler-ca.com> Date: Wed, 19 Sep 2018 17:21:37 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <748c61cb-b6fa-c36d-a7b3-2315ff6292af@schaufler-ca.com> Content-Language: en-US X-Mailman-Approved-At: Thu, 20 Sep 2018 08:30:05 -0400 Subject: [PATCH v3 14/16] LSM: Infrastructure management of the task security blob X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP LSM: Infrastructure management of the task security blob Move management of the task_struct->security blob out of the individual security modules and into the security infrastructure. Instead of allocating the blobs from within the modules the modules tell the infrastructure how much space is required, and the space is allocated there. Signed-off-by: Casey Schaufler --- include/linux/lsm_hooks.h | 2 ++ security/apparmor/include/task.h | 18 +++------- security/apparmor/lsm.c | 15 ++------- security/security.c | 56 ++++++++++++++++++++++++++++++-- 4 files changed, 63 insertions(+), 28 deletions(-) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 416b20c3795b..6057c603b979 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -2031,6 +2031,7 @@ struct lsm_blob_sizes { int lbs_cred; int lbs_file; int lbs_inode; + int lbs_task; }; /* @@ -2098,6 +2099,7 @@ extern int lsm_inode_alloc(struct inode *inode); #ifdef CONFIG_SECURITY void lsm_early_cred(struct cred *cred); void lsm_early_inode(struct inode *inode); +void lsm_early_task(struct task_struct *task); #endif #endif /* ! __LINUX_LSM_HOOKS_H */ diff --git a/security/apparmor/include/task.h b/security/apparmor/include/task.h index 55edaa1d83f8..039c1e60887a 100644 --- a/security/apparmor/include/task.h +++ b/security/apparmor/include/task.h @@ -14,7 +14,10 @@ #ifndef __AA_TASK_H #define __AA_TASK_H -#define task_ctx(X) ((X)->security) +static inline struct aa_task_ctx *task_ctx(struct task_struct *task) +{ + return task->security; +} /* * struct aa_task_ctx - information for current task label change @@ -36,17 +39,6 @@ int aa_set_current_hat(struct aa_label *label, u64 token); int aa_restore_previous_label(u64 cookie); struct aa_label *aa_get_task_label(struct task_struct *task); -/** - * aa_alloc_task_ctx - allocate a new task_ctx - * @flags: gfp flags for allocation - * - * Returns: allocated buffer or NULL on failure - */ -static inline struct aa_task_ctx *aa_alloc_task_ctx(gfp_t flags) -{ - return kzalloc(sizeof(struct aa_task_ctx), flags); -} - /** * aa_free_task_ctx - free a task_ctx * @ctx: task_ctx to free (MAYBE NULL) @@ -57,8 +49,6 @@ static inline void aa_free_task_ctx(struct aa_task_ctx *ctx) aa_put_label(ctx->nnp); aa_put_label(ctx->previous); aa_put_label(ctx->onexec); - - kzfree(ctx); } } diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 15716b6ff860..c97dc3dbb515 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -91,19 +91,14 @@ static void apparmor_task_free(struct task_struct *task) { aa_free_task_ctx(task_ctx(task)); - task_ctx(task) = NULL; } static int apparmor_task_alloc(struct task_struct *task, unsigned long clone_flags) { - struct aa_task_ctx *new = aa_alloc_task_ctx(GFP_KERNEL); - - if (!new) - return -ENOMEM; + struct aa_task_ctx *new = task_ctx(task); aa_dup_task_ctx(new, task_ctx(current)); - task_ctx(task) = new; return 0; } @@ -1132,6 +1127,7 @@ static void apparmor_sock_graft(struct sock *sk, struct socket *parent) struct lsm_blob_sizes apparmor_blob_sizes = { .lbs_cred = sizeof(struct aa_task_ctx *), .lbs_file = sizeof(struct aa_file_ctx), + .lbs_task = sizeof(struct aa_task_ctx), }; static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = { @@ -1457,15 +1453,10 @@ static int param_set_mode(const char *val, const struct kernel_param *kp) static int __init set_init_ctx(void) { struct cred *cred = (struct cred *)current->real_cred; - struct aa_task_ctx *ctx; - - ctx = aa_alloc_task_ctx(GFP_KERNEL); - if (!ctx) - return -ENOMEM; lsm_early_cred(cred); + lsm_early_task(current); set_cred_label(cred, aa_get_label(ns_unconfined(root_ns))); - task_ctx(current) = ctx; return 0; } diff --git a/security/security.c b/security/security.c index 2501cdcbebff..7e11de7eec21 100644 --- a/security/security.c +++ b/security/security.c @@ -116,7 +116,8 @@ int __init security_init(void) #ifdef CONFIG_SECURITY_LSM_DEBUG pr_info("LSM: cred blob size = %d\n", blob_sizes.lbs_cred); pr_info("LSM: file blob size = %d\n", blob_sizes.lbs_file); - pr_info("LSM: inode blob size = %d\n", blob_sizes.lbs_inode); + pr_info("LSM: inode blob size = %d\n", blob_sizes.lbs_inode); + pr_info("LSM: task blob size = %d\n", blob_sizes.lbs_task); #endif return 0; @@ -301,6 +302,7 @@ void __init security_add_blobs(struct lsm_blob_sizes *needed) if (needed->lbs_inode && blob_sizes.lbs_inode == 0) blob_sizes.lbs_inode = sizeof(struct rcu_head); lsm_set_size(&needed->lbs_inode, &blob_sizes.lbs_inode); + lsm_set_size(&needed->lbs_task, &blob_sizes.lbs_task); } /** @@ -364,6 +366,46 @@ void lsm_early_inode(struct inode *inode) panic("%s: Early inode alloc failed.\n", __func__); } +/** + * lsm_task_alloc - allocate a composite task blob + * @task: the task that needs a blob + * + * Allocate the task blob for all the modules + * + * Returns 0, or -ENOMEM if memory can't be allocated. + */ +int lsm_task_alloc(struct task_struct *task) +{ + if (blob_sizes.lbs_task == 0) { + task->security = NULL; + return 0; + } + + task->security = kzalloc(blob_sizes.lbs_task, GFP_KERNEL); + if (task->security == NULL) + return -ENOMEM; + return 0; +} + +/** + * lsm_early_task - during initialization allocate a composite task blob + * @task: the task that needs a blob + * + * Allocate the task blob for all the modules if it's not already there + */ +void lsm_early_task(struct task_struct *task) +{ + int rc; + + if (task == NULL) + panic("%s: task cred.\n", __func__); + if (task->security != NULL) + return; + rc = lsm_task_alloc(task); + if (rc) + panic("%s: Early task alloc failed.\n", __func__); +} + /* * Hook list operation macros. * @@ -1196,12 +1238,22 @@ int security_file_open(struct file *file) int security_task_alloc(struct task_struct *task, unsigned long clone_flags) { - return call_int_hook(task_alloc, 0, task, clone_flags); + int rc = lsm_task_alloc(task); + + if (rc) + return rc; + rc = call_int_hook(task_alloc, 0, task, clone_flags); + if (unlikely(rc)) + security_task_free(task); + return rc; } void security_task_free(struct task_struct *task) { call_void_hook(task_free, task); + + kfree(task->security); + task->security = NULL; } int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)